Application security specialists
Experts in Penetration Testing
of your Web application AI Model Mobile Application Cloud Application IoT & Embedded System Blockchain application
Engineers who attack software
We are software engineers who specialise in attacking software — which is why we find the flaws that require understanding a system, not scanning it. Web applications, REST APIs, mobile and AI-enabled systems, tested by engineers who build their own platform, CybeRapid. Founded in 2010 by Erez Metula, author of Managed Code Rootkits.
What we do
At AppSec Labs, we offer a variety of penetration testing services to ensure the security of your systems. Our team of experts can conduct the following types of tests:
Web Applications
APIs & Web Services
Mobile Apps
AI & LLM Features
Cloud Applications
IoT & Embedded
METHODS
PENETRATION TESTING METHODS
Our objective is to provide you with the most cost effective quality insight into your application security stature
This objective may be achieved used different methods of testing from a totally external test to a security review of the source code.
The Black/ Gray / White box methods are the industry standard options.
Black Box
Black box is a testing method by which the system is tested without having previous information about the target system, no user credentials, no access to the source code, and no knowledge of the architecture. Black Box Testing includes both manual & automatic scans.
Gray Box
Gray box testing is a combination of both black and white box testing and refers to testing a system while having at least some knowledge of the internals of a system. This approach will also include a review of critical parts of the source code, as required by the testing team. Gray Box Testing includes both manual & automatic scans.
White Box
White box is a testing method by which the system is tested with full knowledge and access to system resources (e.g. user credentials, file system, database, etc.), all source code and internal information (interviews with developers/analysts, design documents, admin access, etc.). White Box Testing includes both manual & automatic scans.
What we test
Deep testing of the applications your business runs on
We do one thing: application penetration testing. Web applications, REST APIs and mobile apps — tested by people who have spent years finding the flaws that scanners cannot see, because nothing about the request is malformed. It is simply a request that should never have been answered.
Web application testing
Authenticated, in-depth testing of complex web applications — roles, workflows, business logic and the places where they interact. This is where the findings that actually matter tend to live.
API & web services testing
REST and GraphQL APIs tested as first-class attack surface, not as an afterthought behind the UI. Most mobile and single-page applications are only as strong as the API sitting behind them.
Mobile application testing
iOS and Android applications, the data they leave on the device, and the backend they talk to. We have been testing mobile applications since before there was an agreed methodology for it.
Authorization & tenant isolation
Can one customer reach another's data? Can a low-privileged role reach administrative functions? Broken access control is the flaw class we are known for, and the one automated tools cannot see.
AI & LLM application testing
Applications that embed language models bring new failure modes: prompt injection, business-logic bypass, and models given far more authority than they should have. We test what the model can be talked into doing.
Retesting is included
Every reported finding is retested after your developers have fixed it, as part of the engagement. It is also the point at which many teams discover a fix was incomplete.
Process
Appsec Labs Penetration Testing Process
Kickoff session
1
Testing process
2
Final report
3
Findings overview
4
Repair cycle
5
Retest – optional
6
volutpat
A report your developers can act on
Testing is only useful if someone can act on it. Our reports are written for the engineers who have to fix the problem — reproduction steps, real impact, and a concrete remediation.
The bugs that matter are the ones no scanner will ever report
Authorization flaws, tenant isolation failures, workflow abuse and chained issues do not look malformed to a tool. Finding them takes someone who understands what your application is supposed to allow before they can tell you what it should not.
Human-led, accelerated by our own platform
Automation finds the known patterns. People find the flaws that only make sense once you understand what the application is supposed to do — and that is where the serious findings live.
Built to remove the repetitive work
We built CybeRapid to take the repetitive work out of an engagement, so more of our testers' time goes on the parts that need judgement: attack strategy, business context, and deciding what genuinely matters to you.
Frequently Asked Questions
There are 2 major motivations for a penetration test
- Secure the core of your product for better resilience in a world of evolving cyber crime
- Meeting regulatory requirements many regulators from all industries, such as PCI, HIPAA, FDA, SOC2 and many more require proof of performance of application security testing
Our process begins with scoping which can be performed via a remote meeting in which we will understand what your system does and what you would like tested.
following the session we will provide you with a customized proposal.
Upon completion of the tests, a detailed report will be provided, including an:
- Executive summary
- Security vulnerability findings list - including detailing, and severity rating
- Attack scenarios
- Recommend solutions for mitigation of reported vulnerabilities
As part of your penetration testing project, in AppSec Labs we provide a “retest” following repair of reported vulnerabilities.
We will re-test the vulnerabilities to confirm effective mitigation.
Yes, you get a “‘clean report” stating the system's stature post-penetration test & retest.
Contact us to receive a sample report.
